ServiceNow, Inc. (NOW) Earnings Call Transcript & Summary

Welcome, and thank you for joining us for today's event. Before we get started, we have a few housekeeping tips that will help make your experience more enjoyable. First, today's session is being recorded. [Operator Instructions] One more thing. Your feedback is extremely valuable to us. So please fill out the survey by clicking the icon that looks like a clipboard below. The survey will appear at the end of the webinar. Finally, thanks again for joining us. We hope you enjoy today's webinar. Now let's get started.

Hello, and welcome to our webinar Navigating The Future of Generative AI Governance. My name is John Castelly. I'm the Chief Ethics and Compliance Officer for ServiceNow, and I'm joined by my colleague, Jim Van Over. Jim?

John, how are you doing? This is great, artificial intelligence.

Yes, I've heard a thing or 2 about it. Have you?

I have. I have. What do you say we spend the next 45 minutes or so, just talking about ethics and the future of artificial intelligence and really identifying what the difference is between AI and GenAI and how we should be approaching the ethics and governance of it.

Yes, absolutely, absolutely. We'll spend the time then exploring the challenges and opportunities. We'll discover the key elements of a successful implementation, and then we'll learn how to get started, right? Everyone's on the journey, let's figure out how to take that first step.

Good. And then we'll wrap up with some Q&A. Before we get to the QA, though, let's do a little level set, John. So we start at the top with artificial intelligence, AI. And I think you and I -- we've read a lot about the conflation how many articles that are out there in the Internet right now, conflating artificial intelligence, machine learning and Generative AI. Since OpenAI...

You mean it's not all just AI? Isn't it just all AI?

It's all -- that's true. It is technically all AI. That's not a lie. So if you think of artificial intelligence has the marketing turn, it's the generalized way that we can label it, right? And then machine learning is the thing -- it's that -- the algorithms and operations that have been driving -- depending on how you benchmark it, artificial intelligence from a machine learning standpoint has been around for as long as 20 or 30 years. And it's what's responsible, right, for our -- for a large part of our consumer lives. It's what's driving all of the insights into consumer behavior and data analytics, et cetera, et cetera. But Generative AI, that's the piece that's made a huge splash at the end of 2022 and really exploding in 2023, where we're able to take large data sets and train machines to build models, large language models that essentially are the end of an -- or the beginning of an equation, where, right, whereby if we take the 2 plus 2 is 4. So the first 2 is the language model itself, all the trained data, the aggregate trained data. Then the second 2 is the prompt. You're an ethics officer at ServiceNow. You tell me how to best approach ethics within an enterprise service management environment. And it will do its best with the data that's been trained on to give you the best answer that it can. And I stress the fact that it will do the best it can to answer the question because we all know it's only as good as the data, right?

Yes.

So we -- I wanted to start this off by understanding the 3 levels of what we're talking about. And we are going to massage into machine learning a little bit because that is the sort of meat and potatoes of artificial intelligence in the enterprise environment but everybody is talking about Generative AI. And I think you and I both know, it's a lot of where the -- where enterprises are thinking in terms of risk and compliance and governance because now we're talking about taking data and building it into models or retraining models or how much of my PII is it using? So I think it's really important to delineate what we're talking about. Definitely, we're going to spend a lot of time talking about Generative AI.

Yes. Hey, Jim, I was with you up until you created a robot to take my job. That was a bridge too far.

Well, here's the good news, John. And this is what we were -- we're seeing this across the Internet right now, where a lot of people are concerned about exactly that about creating machines that can do the work of people. But if you look historically, that the evolution of human technology as we enter into the Industrial Revolution 4.0, Web 3.0, you noticed that while there is always a temporary supplanting of specific human jobs within the implementation of an advanced technology, they always create more jobs than they supplant. So the good news is, John, that someday, we'll have 3 or 4 machines that support you in the deployment of artificial intelligence ethics.

I like that, Jim. Let's move to the next slide before I lose any further parts of my job.

So on the heels of that commentary, 80% of business leaders consider Generative AI to be the top emerging technology in the next few years. That's from KPMG. So you've really got -- as the enterprise is transforming, you've really got to think about, do you have a strategy for large language models? And what is your current state of governance for data? Because as you and I have talked about, when you're talking about language models, really when you peel back the layers of the onion, it becomes about data.

Absolutely, absolutely. I've said and I continue to say that AI governance, good AI governance starts with good strong data governance, right? Like you -- at the end of the day, Generative AI is the summation of 2 parts, right, data and the ability for a machine to learn and that summation that is going to be flawed. If any parts of those pieces of the equation are off, I went to law school not quite the mathematician, so I probably fumbled that whole mathematical analogy. But the idea is that data governance is important, right? We have to start from the very foundation of what's building -- what Generative AI winds up being at the end of the day, that output, garbage in, garbage out, so to speak. So let's take care of that data set. Let's make sure it's pristine, let's make sure we're thinking about data as a commodity, not to be commoditized, but it's a commodity that you want to protect that you want to make sure is serving its purpose and ultimately used efficiently and correctly.

So John, if I'm a leader at a large organization, how should I be thinking about data governance from a strategic approach? Like how do -- how should I be thinking about it? How does ServiceNow do it?

Yes. Yes, it's a great question. The first thing you think about is let's at least understand where our data lays, right? What are the pieces of data floating around our company? What are we capturing? What are we -- what information do we store? How are we keeping it secure? Who has access to the data is a point that as companies grow, right, we've seen it with many start-ups to late-stage to public companies, right? You start off with everybody doing a little bit of everything. And then all of a sudden, as you grow, you start getting more specialized in areas. But what doesn't do sometimes specializes is the access of the originals who had a little bit of everything. And then you balloon into an organization where 20,000 people have admin rights, right? Like that's data governance, that's making sure that we're sticking with the right types of levels of access, levels of security continuing to mature. It's an evolution. It's always an evolution when we're thinking about governance and especially when something is fast moving as technology and data.

That's a great way to put it. I love the idea of data evolution and the evolution of governance because it really -- you do put yourself in a terrible position. ServiceNow over the last 15 years has stumbled here and there with -- as we grew so quickly with that with access. And this is not the time and place for those stories. But -- so then moving forward, I've got my data governance strategy in place. So let's talk about how using the GenAI and applying the principles you just described, like how does that help me move forward in my AI governance strategy?

Yes. Well, I think what we think about then is probably, if you think about the regulations, and this is where it comes in because when you think about regulating or having governance around data, it comes down to again, access, security and quality of your data, right? Or do you have -- are your systems being trained on non-biased data? Are they being trained to recognize differences in language or facts or things to that effect. So when you think of the EO in AI, which is the White House executive order in AI, and you think of the EU AI Act, 2 large pieces of regulations at the heart of that, it talks about data governance, right, making sure that you have good data and that your models are being trained on good, strong data. And I think the levels of what the definition of good data that can vary. But at the end of the day, good data again has quality, it has accountability, right? Whereas the big store, who has access to it. And it also has -- you also have to look at your data and think about it is it updated, right? Is it true? Is it factual? Is it accurate? And so when you look at those fundamental pieces and you look at both of these regulations, the fast-growing they have some similarities. The similarities are make sure there are people involved in multiple steps of your AI governance strategy, make sure that your engineers are talking to your developers, who are talking to your salespeople, who are talking to your innovation teams, who definitely will talk with your legal and compliance team, right? Like this is really a team effort here. And I think both of these regulatory acts are definitely reinforcing that it's going to take a village to do this in a responsible, ethical manner. But also, let's not get lost in the fact that we have these 2 really large regulatory aspects growing. Same rules apply, right? And I think one of the things that I talk about in a blog article with ServiceNow is that we've seen this play out before how to develop governance for new emerging technology. We've seen this with ESG, and we've seen this with cryptocurrency and blockchain more recently. When it starts out, it's a little bit of an unfettered territory, a little bit of the Wild West. No one quite knows who the sheriff is, multiple law enforcements are trying to make promulgations and rules to govern. But what ultimately happens is someone or some 5 step up and decide that they're going to enact the pieces of the legislation that or pieces of regulation that they can control. So you'll see a bit of an alphabet suit of regulators here in the United States. The FTC when it comes to transmission of communications and what Generative AI does in chatbots, for instance, right? Any regulation on the Internet. Any of those agencies are going to wind up just using the same tools in their toolkit to regulate and to develop and to just -- I'm sorry, and to expect that companies are developing governance the way they develop governance for products as oldest time as a bottle of Coca-Cola.

Well, this is great. So then if I'm a subscriber to a language model provider, for example, then I can just rely on both of these, and I don't have to worry about anything. Is that what you're saying, John?

I wish it was that simple because all of the states like to get involved. Hey, let's not forget, we still have privacy things like GDPR, which was a massive change for many corporations to actually get ready for a 3- to 5-year period. And then you have the states who like California with CCPA or West Virginia with their Data Privacy Act, you're going to get a myriad of people who are trying to get their arms wrapped around it. And let's not forget, AI is the fun and exciting term to be tossed around. So everyone's kind of want to kind of get their piece of trying to regulate that in their state or territory. So unfortunately, while there's only 2 on the slide, there are many, many to consider.

So I have to be aware not only of these regulations, but also regional, local as they govern things like data and management and usage. And compounding that is if I'm a global organization, I have to manage that for different part -- I can't just blanket say, okay, this is what we're going to do because it's different as the fact that I'm operating as a global organization.

Absolutely. It's different with respect to standards, and it's definitely different between -- with respect to enforcement. So you had some locales and jurisdictions where enforcement is a bit of a lighter touch. You get situations where, again, let's go back to GDPR. You start to the EU and you start seeing regulators actually enforcing GDPR violations, which is something maybe 5 years ago, you didn't think they'd get around to doing that, but they've done it with a certain amount of fervor. So as you're a global company, you've got to know what they say where you play, so to speak, right? So understanding what the rules are, understanding what your regulations are for your environment and where you do business is critical to developing a strong AI governance model.

John, we've introed into AI governance as data governance. We need to be doing our homework. Do we know where the data is coming from? How is it being used? Whether the data is appropriate for the algorithm that's using it? And do you understand the processes that are outputting the results of any machine learning or Generative AI? Do you have visibility into it? Or whether that's -- to your point earlier, whether that's you are the provider that is to say, you stood up your own artificial intelligence division and you're governing it yourself, or you've subscribed to a provider who is providing in which case, it's even more important that you -- that your -- the provider provides the visibility into understanding how that data is being used, when it's being trained on the model, what PII gets stripped out? When does it get stripped out, et cetera, et cetera. So then once you've done that, have you mapped your processes? So you've identified that your provider is good. Now mapping out your processes will help you understand when is appropriate and effective to deploy an artificial intelligence solution. Again, whether it's process mining or machine learning of some kind on data analytics or a Generative AI solution because I think what we're seeing and the way that you and I have been prescribing with our customers is we hear all the time from customers which language model should I subscribe to you specifically talking about GenAI, which language model do I subscribe to? Should I subscribe to Copilot or do I subscribe to Einstein or Now LLM. And what you and I have talked about is that it's not about subscribing to a language model, it's about mapping your processes, understanding what you need done and then deploying the appropriate language model at the appropriate time, orchestrating that within the -- your processes that you've already mapped. So then -- now let's say you have subscribed to 3, I'll just use the 3 examples that I just gave. So you've got Microsoft Copilot, you've got Salesforce Einstein and you've got ServiceNow's Now LLM. And each one of those is going to be effective in different use cases. But then you have to consider the cost, how much does it cost my organization? And can I do a projection of the savings? Because this is the other part is that the upfront cost of Generative AI is very high and you have to have an effective team to be able to project forward and recognize the value ahead of time or you're going to get a lot of leadership saying, this is $100,000 a month just for this one capability and you have to be able to say, yes, but this is the savings. We are going to save $5 million a year or $5 million every month. And I think the power is we haven't discovered and unlocked the full capability of Generative AI. Regardless of what the numbers are, you have to know what they are. You have to be able to do the homework so that you can be prescriptive about what language model you're using? When you're using it? And how much does it cost? And are you getting the value?

Yes. Yes. That's great. I'm glad that we're talking to this because I think this is the part that goes unsaid sometimes when we're hearing about companies racing the Generative AI sort of race here is at this point, these upfront costs when you're trying to build this out is where it's critical to make sure that we have data privacy and security key elements built in that you're thinking the ethical use of what this end product is going to be. I guarantee you that if you take shortcuts in trying to pinch a penny here, save a dollar there in order to maximize sort of more of that long-term gain, you're going to wind up stumbling. You're going to wind up creating something or having something get out of control, which you'll answer for, right? You don't -- nobody wants to be sort of the first test out of one of these alphabet sub-agencies for GenAI missteps, right? When you're -- when the rest of your company -- when the rest of your peers are running fast and furious because they took the time to build in a governance model when it was manageable as opposed to sort of waiting until it became bloated and then you're trying to backtrack a bit, you're stumbling out the gate a little bit. So it's at this moment here, right, that it's important to invest in the proper resources, make sure you have a team of people who are dedicated to thinking about these issues, specifically the ethical issues. I know it sounds a little bit self-survey coming from me. But the ethical issues are important. It's important to have the right types of folks who can actually do a balance of business, right, innovation, business and profitability versus the ethical concerns. And I think you probably have a team like that somewhere within your companies if you have an ethics and compliance team, I think they are a good place to start with helping you think through how do we ring-fenced some of this. And by ring-fenced, you want to keep thing -- it can be a really large fence and you can have a large territories that can continue to grow. But nonetheless, you want a fence around. I don't know why this just came to me, but I drive a lot in California, and I'm a New York City kid. But every now and again, it blows my mind to drive in California and see herds of cows everywhere. And it's a large vast of land and they're allowed to kind of be anywhere in the property, but you better believe there's a fence somewhere to stop them from roaming off and getting out of control there. It's the same sort of concept. Large fence but a fence, nonetheless.

Right. Then -- and I love that you brought up the human element of it. We -- you and I both know that the most important part of this conversation are the people. And so my -- the next part of this for me is if I'm -- so I'm a leader. I've got everything that we've talked about in place. I've got the data governance. I've got the AI governance. I understand. I've been provided the visibility by my service providers for machine learning and GenAI and I am looking to hire a team. So understanding that ethics are -- ethics are a critical part of the value chain in that you should be thinking about hiring resources and building out ethics around specifically artificial intelligence because the cost of not doing so is more than the cost of doing it. So with that in mind, who should I be thinking about? What kind of either the specific roles or specific skill sets, how am I building out an AI ethics team, John?

Yes. Great, great question. And it's a question that we're doing full transparency. We're still on our journey here at ServiceNow, right? How do we make sure we have the right folks in place? I think the first and most important part is you do need -- if you do not have one, you do need a Chief Ethics and Compliance Officer in your organization, right? You need someone who's responsible on a daily basis, thinking about ethics and culture and the compliance aspect of it. This can't be someone that is moon lighting, right? You can't have someone that is developing also the -- it's just -- it just doesn't lend itself to a fulsome sort of thoughtful review of your program. So you definitely want to make sure you have one of those. And in fact, I believe it might be the EU AI active calls for an AI ethics officer to be somewhere designated, right? Who is the person responsible for at the end of the day and making sure we have processes and programs in place. But you also need to hire technical people, right? Like one of the things that I've evolved into in my role is it's not just about looking at regulations and interpreting regulations and checking boxes whether or not you are meeting those standards. It's also about understanding your business and understanding what's being developed and what's key and be the best type of team that you can be, you have to be a partner to the business. So you need folks who understand machine learning and they understand models and they understand LLMs, they understand what the technology is, right? So you want technical people who are also responsible for understanding where -- so that you can understand where are the -- how far out can this thing go, right? Like, I mean, not every Generative AI idea that comes into a corporation is going to be a high risk, right? A lot of companies are doing sort of low risk, [ not earn shadow ]. We're not talking about self-driving cars necessarily or health care decisions, the types of things that get a lot of the press but you still want to understand how far -- what is the -- what's the worst-case scenario, right? If we're doing chatbox to -- for our customers, and that's being -- that's all GenAI, is there a risk of hallucinations where they get a response from a chatbot that sends them on a path that they normally wouldn't take? Like that's usually the range of risk with some of these things. Have someone thinking about that. How -- what does it look like if it goes bad, how do we fix it? How do we prevent it, how do we build a better mousetrap, are some of the folks that you want to think about.

And if I've got 20,000 people, John, there is a very good like -- there's a likelihood a not insignificant likelihood that I'll have employees who are misbehaving, it's just as simple as that with 20,000, 30,000, even 100,000, the more people you add, the more likely it is that you'll get somebody who misbehaves whether that's a bad actor that unfortunately shouldn't work for an organization or whether it's somebody who was, for example, laid off, but their access still exists. The opportunity to take advantage of the system for your own personal means for better or worse, needs to be thought about by a person or a group of people inside our organization to protect the organization, right?

Absolutely. Absolutely. And so you want to make sure that your innovators are talking to your legal professionals who are also talking to your ethics and compliance team. This is where that village mentality comes into place, right? Like you need everyone just kind of getting a little bit of information, some support from these other groups. It makes a world of a difference.

My office has to talk to legal. I didn't know that. Okay.

I know. Well, -- yes, how -- why do you think I got you here, Jim? Is it...

Got something important to tell you. No, that's a great point. And so often, we take for granted the silos and when things -- especially when things are going well. And it's -- we always need to be making sure that all parts of our organization are communicating with each other and that everybody understands what the responsibilities are and what the fences are exactly to your point. And then to double down on what you said earlier, for making sure that there is a Zero Trust aspect to it as well. So that's we don't have to rely on people being good people, the technology takes care of it.

That's right. That's right. And though I was being glib a little earlier about the robots coming for our job. I think it's really important to say that AI or GenAI is not a way to replace people, it's a way to enhance, right, the work and the efficiencies. It's to be a helper and help drive the execution. And I think it's -- so the people are important. They're central. Not only do the regulatory bodies and agencies say that, but also just there -- just the idea of you cannot thrive without having humans at the center of your AI -- GenAI strategy. You need that innovation. You need that care for humanity. You need all of those pieces that make us unique. So just an FYI on that too, I think it's important.

I agree. I think it's very shortsighted of organizations who are approaching artificial intelligence strategies from a perspective of resource cutting. I think that Bill McDermott would agree with us that the opportunities to scale far outweigh the shortsighted opportunities of reducing headcount, for example.

Right. That's right.

And if I can take a group of customer service managers, that are 15 people and infuse them with the power of artificial intelligence and give them the equivalent of 50 people that is far more effective for my organization than cutting half that group.

Yes, absolutely. Absolutely. And while we're bringing up Bill and things that he would say, one of his most quoted is that trust is gained and drops and lost in buckets, right? And we drive by that here at ServiceNow because governance is good for business because it builds trust, right? If you have a strong governance around the products that you are having people subscribe to or have customers use, then your customers feel good about the fact that, hey, this is kind of covered because this is a trustworthy company. They're reputable. They do what they say. Look, they have a standard on AI governance, and they talk about it and they're leading. What do you think about that? Sometimes we talk about these things like governance and as a cost or hindrance to business, but what will be your thoughts on that, Jim?

John, you're hitting it right on the head. And I think that we need to be thinking more and more about governance as it directly connects to trust. I think you drawing that line there is absolutely the way to be thinking about it. Governance -- good governance is trust and trust is the foundation that drives the stickiness of both employees and customers to our business. So without good governance, we don't have the trust of our employees and customers and without employees -- the trust of our employees and customers, we don't have a business.